tests: add a special setup where rebase.useBuiltin is off

diff --git a/patch-delta.c b/patch-delta.c
index e02e13bd4eb2a92626c2d6f9cbf264abb15de9c5..b5c8594db60dd19fbe18b95ea79439c7bad3fa40 100644 (file)
--- a/patch-delta.c
+++ b/patch-delta.c
@@ -33,32 +33,38 @@ void *patch_delta(const void *src_buf, unsigned long src_size,
 
        /* now the result size */
        size = get_delta_hdr_size(&data, top);
-       dst_buf = xmalloc(size + 1);
-       dst_buf[size] = 0;
+       dst_buf = xmallocz(size);
 
        out = dst_buf;
        while (data < top) {
                cmd = *data++;
                if (cmd & 0x80) {
                        unsigned long cp_off = 0, cp_size = 0;
-                       if (cmd & 0x01) cp_off = *data++;
-                       if (cmd & 0x02) cp_off |= (*data++ << 8);
-                       if (cmd & 0x04) cp_off |= (*data++ << 16);
-                       if (cmd & 0x08) cp_off |= ((unsigned) *data++ << 24);
-                       if (cmd & 0x10) cp_size = *data++;
-                       if (cmd & 0x20) cp_size |= (*data++ << 8);
-                       if (cmd & 0x40) cp_size |= (*data++ << 16);
+#define PARSE_CP_PARAM(bit, var, shift) do { \
+                       if (cmd & (bit)) { \
+                               if (data >= top) \
+                                       goto bad_length; \
+                               var |= ((unsigned) *data++ << (shift)); \
+                       } } while (0)
+                       PARSE_CP_PARAM(0x01, cp_off, 0);
+                       PARSE_CP_PARAM(0x02, cp_off, 8);
+                       PARSE_CP_PARAM(0x04, cp_off, 16);
+                       PARSE_CP_PARAM(0x08, cp_off, 24);
+                       PARSE_CP_PARAM(0x10, cp_size, 0);
+                       PARSE_CP_PARAM(0x20, cp_size, 8);
+                       PARSE_CP_PARAM(0x40, cp_size, 16);
+#undef PARSE_CP_PARAM
                        if (cp_size == 0) cp_size = 0x10000;
-                       if (cp_off + cp_size < cp_size ||
+                       if (unsigned_add_overflows(cp_off, cp_size) ||
                            cp_off + cp_size > src_size ||
                            cp_size > size)
-                               break;
+                               goto bad_length;
                        memcpy(out, (char *) src_buf + cp_off, cp_size);
                        out += cp_size;
                        size -= cp_size;
                } else if (cmd) {
-                       if (cmd > size)
-                               break;
+                       if (cmd > size || cmd > top - data)
+                               goto bad_length;
                        memcpy(out, data, cmd);
                        out += cmd;
                        data += cmd;
@@ -76,6 +82,7 @@ void *patch_delta(const void *src_buf, unsigned long src_size,
 
        /* sanity check */
        if (data != top || size != 0) {
+               bad_length:
                error("delta replay has gone wild");
                bad:
                free(dst_buf);